Is your internet up to date?

Re:Is your internet up to date? by lmns on Monday January 09, 2017 @08:31AM (#13356171)

> If you also want to secure a lookup of, for example, pool.ntp.org then DNSSEC for A and AAAA records also makes sense.

The fun part begins when you realize you can't validate DNSSEC because your time drifts too much. So how do you get your initial sync from pool.ntp.org with DNSSEC validation enabled?

[ Parent | on HN ]

Re:Is your internet up to date? by okket on Monday January 09, 2017 @08:49AM (#13356255)

Also, at the moment you do not get much by checking their broken DNSSEC entries:

http://dnsviz.net/d/pool.ntp.org/dnssec/

[ Parent | on HN ]

Re:Is your internet up to date? by phicoh on Monday January 09, 2017 @08:52AM (#13356273)

If the DNSSEC validating resolver is a server then it is usually not an issue. Most server hardware has battery backed real time clocks. In the odd case that you are bootstrapping a server you would have to set the time manually or make setting the time part of bootstrap process.

For embedded systems that don't have a battery backed real time clock and want to do local DNSSEC validation this is indeed an issue.

There are plenty of hacks to make it work, but no real standard.

[ Parent | on HN ]